The Supreme Court has struck down a Vermont law that limited the use of …

Does the First Amendment allow governments to regulate behavioral advertising? That question wasn't the Supreme Court's focus in the case of IMS v. Sorrell. But Thursday's decision striking down a Vermont regulation of drug industry marketing practices could have implications for privacy law more generally. Ars talked to two legal experts about the merits of the decision and what it says about the future of privacy on the Internet.

This is your court on drugs

Drug companies market their wares by dispatching sales representatives, known as "detailers," to meet individually with doctors. Detailers explain new products, answer questions about existing products, and provide information they hope will convince the doctors to prescribe their employers' products more often.

A detailer relies heavily on data about a doctor's prescribing history to help craft a sales pitch. The information helps the detailer figure out which products to talk about and to judge how effective past sales efforts have been. The Vermont legislature became concerned that detailers were becoming too successful at convincing doctors to prescribe expensive name-brand drugs rather than low-cost generics. So they enacted regulations limiting detailers' access to prescription data.

The pharmaceutical industry sued, alleging that these regulations violated the First Amendment by impermissibly burdening detailers' speech. In a 6-3 decision written by Justice Anthony Kennedy, the Supreme Court ruled the Vermont law unconstitutional. Vermont described it as a privacy measure, but Kennedy notes that the law allows prescription data to be used for almost any purpose except detailing. Hence, he argued, it was less a privacy regulation than an attempt to discourage a particular, disfavored type of speech.

Writing for the three dissenting justices, Justice Stephen Breyer didn't dispute that the Vermont law was a speech regulation, but he criticized the majority for giving strong First Amendment protections to speech that is commercial in nature. A number of past decisions have held that the government has greater latitude to regulate commercial speech than non-commercial speech. Breyer warned that abandoning this principle would lead the courts into a jurisprudential quagmire. The government tightly regulates a variety of commercial speech, such as regulations of drug packaging and advertisements, and Breyer argued that the courts shouldn't be second-guessing those rules.

Is aggregate data like beef jerky?

Ars talked to Jim Harper, a privacy scholar at the Cato Institute. Harper is a critic of the commercial speech doctrine, a view also reflected in Cato's amicus brief in the case. He praised Thursday's decision, which he said shows that "you have to be addressing a genuine, recognizable harm for a privacy regulation to hold up" to First Amendment scrutiny.

But that is precisely the problem, argued Greg Beck, an attorney at Public Citizen who filed a brief of his own on the other side. "In many cases when you're dealing with privacy statutes, the harms you're trying to avoid are difficult to quantify," he told Ars. People might feel violated when their private information is used in ways they didn't expect, but have trouble articulating exactly why.

Harper believes that privacy regulations always raise free speech concerns. "Privacy is the claim to prevent true information about yourself from being communicated," he argued. The government should only be able to do that if it has a compelling reason to do so. Vague feelings don't make the cut.

Beck countered that the kind of aggregate information at issue in the case lacks the expressive element required for strong First Amendment protection. Data aggregation "isn't something that expresses any kind of viewpoint or has any other values that the First Amendment protects." Aggregate information is more akin to an ordinary commodity—a lower court compared it to beef jerky—that the legislature has broad latitude to regulate as it sees fit.

Crafting constitutional privacy regulations

So does Thursday's decision affect proposals for government regulation of behavioral advertising? This practice—using data about a user's browsing history to guide ad selection—is strikingly similar to the "detailing" strategies used by pharmaceutical companies. If Congress or a state legislature tries to regulate online tracking, the industry may ask the courts to strike those regulations down using Sorrell as a precedent.

Harper and Beck largely agreed on this question. Harper noted that one of the key defects of the Vermont legislation was that privacy protection clearly wasn't its primary goal. Rather, he said, arguments about privacy were "tacked on" to justify a regulation that was primarily about regulating commercial speech.

Beck agreed, noting that the legislative history showed the Vermont legislature was concerned detailing was too effective at convincing doctors to prescribe their products. Regulating speech because it's perceived to be too persuasive is a constitutional no-no. After Sorrell, legislatures will need to design privacy regulations more carefully, focusing on "concrete harms that individuals suffer because of the practice that they're trying to restrict."

Beck also argued that legislators would need to be careful about the scope of regulations they enact. If regulations are too narrow, they might be struck down for unfairly targeting a particular group. On the other hand, if rules are too broad, they may be held unconstitutional for burdening more speech than is justified by the government's stated rationale. Legislatures will need to "walk a tightrope" between these extremes.

Harper suggested that legislatures will have an easier time regulating the collection of personal information than the use of it. And Beck argued that courts are more likely to uphold privacy regulations if the information being protected is seen as highly personal. He noted that the pharmaceutical industry challenged only the portion of the Vermont law that limited use of doctors' aggregate prescription data, not more sensitive information about individual patient subscriptions.

What does all this mean for online privacy regulations? The law remains extremely unclear, but Beck argued that browsing history is the kind of sensitive personal information that provides a compelling enough rationale to overcome First Amendment concerns. And Harper's analysis suggests that limits on collecting browsing data are more likely to be found constitutional than regulations governing the use of browsing data after it's been collected. The Sorrell decision means legislators will have to put more thought into future privacy regulations. But it suggests that carefully crafted regulations can still survive judicial scrutiny.

Disclosure: I'm an adjunct scholar at the Cato Institute, an unpaid position.

Timothy B. Lee / Timothy covers tech policy for Ars, with a particular focus on patent and copyright law, privacy, free speech, and open government. His writing has appeared in Slate, Reason, Wired, and the New York Times.